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We present an experimental demonstration of a quantum key distribution protocol using coherent 
polarization states. Post selection is used to ensure a low error rate and security against beam 
splitting attacks even in the presence of high losses. Signal encoding and readout in polarization 
- - bases avoids the difficult task of sending a local oscillator with the quantum channel. This makes 

^'^^ , our setup robust and easy to implement. A shared key was established for losses up to 64%. 
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I. INTRODUCTION 



The first quantum cryptography protocols used measurements of noncommuting observables of single photons to 
establish a secret shared key between two parties 0. By evaluating the errors in the shared key, it is possible to 
00 . spot a potential eavesdropper and estimate his knowledge about the key. As there are no reliable, deterministic and 
fast single photon sources available at the moment, most implementations of such single photon systems use weak 
coherent pulses instead. Due to the problem of multi-photon components of coherent states in those systems the 
effective amplitude has to be very low, which again impairs the performance. A second drawback is the lack of fast 
and efficient single photon detectors, whereas bright light photoreceivers work with nearly unit quantum efficiency at 
■ hirfi speeds. Thus, a new number of quantum cryptography systems employing coherent states have been proposed 
! Ql^ ^1 ^1 ■ To establish a shared key when the state is attenuated — single photons are either completely lost or 
. transmitted — special techniques have been proposed 0, E| . Reverse reconciliation used in Q demonstrated for the 
\l ' first time the robustness of continuous variable systems against losses of more than 3dB, but it requires strict one 
, way communication and relies on interferometric stability for the transmission of a local oscillator beam. For low 
• transmission losses a cryptography system using post selection of quadrature measurements was presented in 
Oh! llClj|. using also a separate phase reference pulse. In this work, we demonstrate experimentally for the first time 
that post selection of coherent states can also establish a shared key in the presence of high losses. In contrast to 
^ ' other experiments 0,1^, which encode information in the phase of coherent states, we use polarization encoding. 
This dispenses with the need of a separate local oscillator beam, and increases detection efficiency, making our system 
more suitable for practical applications. 



II. POST SELECTION 

A coherent state with amplitude a is an eigenstate of the annihilation operator a and can be represented as an 
expansion in the Fock basis with photon number n = (n) = (a^d) j^: 

As formulated by the Heisenberg uncertainty principle, a coherent state occupies a certain area in phase space, such 
that two coherent states \+a) = e*"|a) and |— a) = e^'^ja) exhibit an overlap 

/ = e-2|"^ (2) 

As a result, a measurement of the quadrature amplitude x = (a^ + d) cannot discrimiate deterministically between 
\+a) and |— a) for small \a\, as measuring of \+a) may yield results that could have been produced by a measurement 
of a state and vice versa. When a sender (Alice) prepares randomly one of the two non-orthogonal states, and a 
receiver (Bob) guesses which state it was by measuring x, his error probability Pe — Prob{x < | \+ct)) + Proh{x > 
I |— a)) is directly linked to the amplitude \a\ and the resulting overlap /. The shared information between Alice 
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and Bob, Iab, can then be determined. It depends on Alice's am plit ude |a|, Bob's amplitude measurement result x 
and the transmission rj of the channel between Alice and Bob jT^, US • 

Iab = 1 +Pelog2Pe + (1 -Pe)log2(l -Pe). (3) 

We now consider a beam splitting attack, where a potential eavesdropper (Eve) splits off part of the signal which is 
lost in the channel with transmitivity 77, and transmits the rest with a hypothetical lossless channel, such that her 
presence is undetectable. Eve can then make measurements on her part of the signal, e.g. an amplitude measurement 
like Bob. A crucial point in the experiment is that for coherent states Eve's and Bob's individual measurement 
outcomes are independent within their respective probability distributions. Thus Eve may obtain inconlusive results 
while Bob is quite confident about the state Alice prepared, and vice versa. Alice and Bob can determine the error 
probability and mutual information Iab for each single event after the measurement. The average information Eve 
can get depends on the amplitude a Alice prepares and Eve's portion of the signal (in this case y^l — rj), giving a 
mutual information of Iae between Alice and Eve. For a given channel transmission rj and state overlap governed 
by |a| a threshold t for Bob's measurement can be given so that all his results with \x\ > t meet the condition 
Iab > Iae- The shared knowledge between Alice and Bob about such events is larger than that shared between 
Alice and Eve, allowing a secret key to be distilled. The process of sorting out those events which are favourable for 
Alice and Bob after the data have been recorded is called post selection T6j. 



III. POLARIZATION STATES 



The measurement of conjugate quadratures (e.g. amplitude and phase) of an optical mode normally requires a 
separate phase reference (local oscillator). Our system utilizes the quantum polarisation of a two mode coherent 
state, providing its own built in strong reference field. The quantum Stokes operators are used throughout this work 
to describe the quantum polarisation. They are defined in analogy to the classical Stokes parameters [T3 |. If one 
defines the annihilation operators d^/y for two orthogonal polarization modes the Stokes operators read: 



5*0 = at 



alay, Si =alax-alay, 



S2 = aldy + alcLx, S3 = i{dlax ~ d\ay). 
Their commutator and the corresponding uncertainty relations (with V denoting the variance) 



(4) 



S'fc, Si 



^^^klmSn 



k,l,m ~ 1, 2, 3 



(5) 



VkVl>\eklrn{Sm)\'' (6) 

ensure that no two operators can be measured simultaneously with certainty, as long as the third is nonzero. 
This behaviour is similar to quadrature operators, with the exception that the size of the uncertainty area of two 
observables depends on the mean value of the third. In the experiment, the 5*1 component is chosen to be large, which 
corresponds to an almost completely horizontally polarized light beam with 5*2 and S3 as noncommuting observables. 
The state overlap in 6*2 and 6*3 can be utilized analogous to the state overlap in field quadratures. The Stokes 
operators are measured by direct detection The mode with high photon number ax is used as a phase reference 
to determine the photon number in the dark mode ay of orthogonal polarization. The 6*2 and S3 components can be 
measured by applying appropriate phase shifts between d^ and dy and using a balanced photodetector. Note that in 
conventional homodyne detection, the signal and the local oscillator are in two spatially separated modes. Thus the 
spatial overlap and the phase stability limit the efficiency of such a setup, while our polarization setup has perfect 
spatial overlap and a stable relative phase by default without active control. 



IV. PROTOCOL 



The key distribution protocol works with a BB84-type prepare and measure strategy. By small modulations of the 
Si polarized cw beam, four coherent states with slightly positive (negative) {S2) and {S3) are produced. Fig. ^shows 
possible measurement outcomes for Bob, when he uses a 50:50 beam splitter to measure S2 on one half, and S3 on the 
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FIG. 1: Plot of possible Q-function measurement results for Bob. Alice produces four coherent states with either positive or 
negative S2 and 5*3 polarization. In the experiment, the state overlap is high, thus the states cannot be distinguished. In this 
figure, the overlap is low for better visualization. 

other half of the beam (see also Fig. 0J . Alice prepares randomly one of these four states and Bob chooses randomly a 
measurement basis out of S2 and 6*3. By assigning a bit value "1" ("0") to a positive (negative) measurement result, 
a shared key can be established. Then Bob discards all results that did not exceed the post selection threshold. He 
then announces his measurement bases through the public channel so that Alice knows Bob's measurement result 
with high probability. In the case of vanishing overlap between the states, this procedure is deterministic and hence 
insecure. An eavesdropper may discriminate between all four states and launch an intercept /resend type attack 
without being noticed. By using states with a considerable overlap, the error probability for Eve increases, while Bob 
and Alice can post select favourable events. 



Our experimental apparatus consists of independent setups for Alice and Bob which are separated by roughly 30 cm. 
Alice controls the laser source and the state preparation. Bob performs the polarization measurements on the states 
he receives from Alice. 



Her schematical setup is shown in Fig. [5] As a light source a commercial diode laser is used (TOPTICA DLIOO). 
The diode provides up to 40 mW cw optical power and is wavelength stabilised to 810 nm. After mode cleaning of the 
laser light by a standard telecom fibre (SMF 1528) it is polarized in 5*1 direction using two polarising beam splitters 
for improved purity. The S'3 modulation is achieved by an electro-optical modulator (EOM). The S2 modulation of 
the beam is done by a magneto-optical modulator (MOM) which uses the Faraday effect of a magneto-optically active 
glass rod (Moltech MOS-04). The overall attenuation of the sender setup was adjusted to give a cw output power of 
0.5 mW of Si polarized light. By controlling the applied modulation voltage on the EOM and the current through 
the MOM coil, the polarization amplitude in the S3 and ^2 direction can be adjusted continuously. Each single event 
in the experiment is represented by a 500 /xs long interval of modulation on the continuous Si beam. 



V. 



EXPERIMENT 



A. 



Alice 



B. Bob 



At the receiving station Bob measures either the S2 or 53 displacement. The incoming beam polarization is 
adjusted according to by a half wave plate and a second EOM. To switch between S2 and S3 the EOM changes 
from " no retardation" to " quarter wave retardation" . The beam is focussed by a lens through a high quality calcite 
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FIG. 2: Schematical view of Alice's setup. 
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FIG. 3: Schematical view of Bob's setup. 



WoUaston polarizer with an extinction coefficient higher than 10^. The two resulting beams are each reflected by 
a low loss mirror onto silicon PIN photodiodes (Hamamatsu S3883). The detectors show a linear behaviour up to 
1 mW incident power. With an incident power of 250 /iW, the electronic noise is more than 10 dB below the signal 
noise for modulation frequencies above 20 kHz. The signal is recorded by a fast digitizing oscilloscope (Tektronix 
TDS 420) and transferred to a computer for Bob's data processing. 



VI. RESULTS 



To show the independence between single results of the two measurement distributions in the case of a beam 
splitting attack, the signal is divided by a 50:50 splitter and measured by two Stokes detector setups (see Fig. QJ. 
When both detectors are set to measure in the same basis (in this case 5*2), an unmodulated S\ polarized coherent 
state gives rise to independent Gaussian distributions in each detector. The results of detector 1 and detector 2 are 
uncorrelated, as can be seen in Fig. |Hl(left). For a S2 modulation with low amplitude, the plot (Fig. right) shows a 
slight ellipticity, revealing small correlations between the signals of the two detectors. Although the two parties share 
common information it is not possible to deduce the sign of the measurement result of one detector from the outcome 
of the other detector with certainty. A potential eavesdropper who uses detector 2 cannot infer the results of detector 
1, even though she has measured 50% of the signal. Note that the setup of Fig. 21 was also used with one ^2 and one 
53 detector to produce Fig. ^ 

In the QKD experiments, only a single detector with electro-optical basis switching (see Fig. O was used. The losses 
due to non-unity photodiode efficiency, limited EOM transmitivity and optical imperfections in the detector were 
treated as if they were transmission channel losses. This conservative point of view implies that Eve could manipulate 
Bob's receiver and increase its efficiency while sending more imperfect states at the same time, gaining additional 
information. With an additional attenuator between Alice and Bob, the overall transmission levels were set to either 
79% or 36%. The modulation was adjusted to give an average coherent amplitude of |a| = 0.6 in the dark mode Oj,, 
yielding an overlap of / = 0.5 according to Eq.Q. A typical readout of the oscilloscope is shown in Fig. The main 
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FIG. 4: Schematical view of Bob's setup, using two detection setups to measure simultaneously S2 and Sz with a loss of 50%. 
If the quarter wave plate is removed, S2 can be measured on both halves of the original beams. 




FIG. 5: Signal divided by a 50:50 beam splitter and measured by two S2 detectors. Left: no Si modulation of the signal. 
Right: small ^2 modulation, correlations of the two detected signals result in elliptical shape of the scatter plot. As detector 1 
and detector 2 have slightly different gains, a small horizontal ellipticity is introduced in both graphs. 



graph shows eleven intervals of constant measurement basis. The upper inset shows the oscilloscope trace for a period 
of 0.1 s corresponding to 200 measurement intervals. The abrupt changes of the signal are due to the basis switching 
by Bob's EOM. Alice's modulation pattern for one single event, as well as Bob's oscilloscope samples are shown on 
the right. By integrating over the oscilloscope samples in the center of the event where Alice applied a modulation. 
Bob retrieved a measurement result, while the samples at the beginning and the end of the event interval served as 
calibration data. 

Bob then assigned a bit value to each measurement. After that, all events where Bob's measurement value was below 
the post selection threshold were discarded. Table shows the relevant parameters for the case of low loss as well 
as for high loss. All rates are given in bits per second. While the raw bit rates are nearly equal for both scenarios. 




Event Number 

FIG. 6: A typical oscilloscope trace of the detector signal with constant basis. Owing to the large overlap the signal modulation 
is not apparent in the graph. The inset shows the whole trace, with visible jumps due to basis switching by the EOM. One 
single event, with modulation pattern (solid line) and oscilloscope samples (dots) is shown on the right. 
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2 1/0 loss 


d47o loss 


raw bit rate in bit/s 


1069 


1096 


errors before post selection 


22.0% 


27.3% 


bit rate after post selection 


415 


165 


errors after post selection 


6.0% 


7.6% 


post selection threshold t 


1.0 


2.3 


information advantage 


0.76 


0.49 


max. bit rate after error correction 


249 


80 


max. bit rate after priv. amp. 


189 


39 



TABLE I: Experimental key generation parameters for high and low losses. The raw rate, rate after post selection and 
information advantage as well as the error fraction are experimental results. The maximum rates after error correction and 
privacy amplification are theoretical predictions for the availabe data. The post selection threshold is given in units of the 
coherent amplitude a. 

a higher post selection threshold was used in presence of 64% loss, to ensure a considerable information advantage 
Iab — Iae for the selected bits. Thus the bit rate after post selection is much lower for the high loss case. Note 
also that the errors in Bob's key drop dramatically after post selection, so that a subsequent error correction with 
standard procedures is now possible. The higher error probability in the high loss case originates from the increased 
overlap of the states (cf. Eq. |(2Jl) as the coherent amplitude a decreased with transmission losses. 
The bit rate after error correction with the established Cascade protocol |3] is given for the optimum block length 
and 5 passes of the protocol. The potential final bit rate can be calculated from the information advantage and the 
error corrected bit rate. Bits needed to authenticate the public channel are not taken into account. In both loss 
scenarios it was possible to produce a nonzero bit rate of shared bits. 

Note that, in contrast to the reverse reconciliation method used in 8], the error correction does not take place on the 
raw key (with approx. Ikbit/sec) but on the post selected key (with approx. 400bit/sec and 150bit/sec respectively), 
thus needing less capacity on the classical channel. Also, we achieved a key exchange with direct reconciliation in the 
presence of 64% loss, corresponding to a —AAdB quantum channel transmittivity. 



VII. CONCLUSIONS 

The system can be further improved e.g. in the receiver design. If one uses a setup similar to that used to 
generate the plot in Fig. [H (see Fig. 0)), Bob's detector would not require active basis switching, like in some single 
photon systems, e.g. The theoretical upper bound for detection speed is then the bandwidth of the balanced 

detector, which can be very high compared to photon counters in single photon experiments. When using polarization 
dispersion compensation, the scheme can also be adapted to fibre transmission lines by replacing the 810 nm coherent 
laser source with a 1.5 /im laser. 

To conclude, we have demonstrated a quantum key distribution system that relies on readily available coherent states, 
continuous variable measurements and post selection to generate a shared key between Alice and Bob. The states are 
polarization encoded, ensuring fast modulation, and perfect mode overlap in Bob's homodyne detector. There is no 
need to send a separate local oscillator along with the quantum channel. The system is robust against losses of more 
than 50% and does not need special reconciliation techniques which require strict one way error correction protocols 
such as in 0. Its implementation is straightforward and can be used e.g. in free space communication with high 
efficiency and key exchange rate. 

VIII. ACKNOWLEDGMENTS 

This work was supported by the Federal Ministry of Education and Research (BMBF/VDI) under FKZ:13N8016. 
The authors would like to thank U. Andersen, J. Schneider and A. Berger for technical assistance and for help with 



7 



the preparation of this manuscript. 



[1] G. A. Barbosa, E. Corndorf, P. Kumar, and H. P. Yuen, Secure communication using mesoscopic coherent states, Physical 

Review Letters 90 (2003), no. 22. 
[2] C.H. Bennett, Quantum cryptography using any two nonorthogonal states, Physical Review Letters 68 (1992), no. 21, 

3121-3124. 

[3] G. Brassard, N. Liitkenhaus, T. Mor, and B. C. Sanders, Limitations on practical quantum cryptography. Physical Review 

Letters 85 (2000), no. 6, 1330-1333. 
[4] G. Brassard and L. Salvail, Secret-key TeconciUation by public discussion, Advances in Cryptology EUROCRYPT '93 

(T. Helleseth, ed.). Lecture notes in Computer Science, vol. 765, Springer, 1994, pp. 410-423. 
[5] N. Gisin, G. G. Ribordy, W. Tittel, and H. Zbinden, Quantum cryptography. Reviews of Modern Physics 74 (2002), no. 1, 

145-195. 

[6] R.J. Glauber, Coherent and incoherent states of the radiation field. Physical Review 131 (1963), no. 6, 2766-2788. 
[7] F. Grosshans and P. Grangier, Reverse reconciliation protocols for quantum cryptography with continuous variables, quant- 
ph/0204127 (2002). 

[8] F. Grosshans, G. Van Assche, J. Wenger, R. Brouri, N.J. Cerf, and Ph. Grangier, Quantum key distribution using gaussian- 

modulated coherent states, Nature 421 (2003), 238-241. 
[9] T. Hirano, T. Konishi, and R. Namiki, Quantum cryptography using balanced homodyne detection, quant-ph/0008037 

(2000). 

[10] T. Hirano, H. Yamanaka, M. Ashikaga, T. Konishi, and R. Namiki, Quantum cryptography using pulsed homodyne detection. 

Physical Review A 68 (2003), 042331. 
[11] P. Horak, The role of squeezing in quantum key distribution based on homodyne detection and post-selection, quant- 

ph/0306138 (2003). 

[12] B. Huttner, N. Imoto, N. Gisin, and T. Mor, Quantum cryptography with coherent states. Physical Review A 51 (1995), 
no. 3, 1863-1869. 

[13] N. Korolkova, G. Leuchs, R. Loudon, T.C. Ralph, and Ch. Silberhorn, Polarization squeezing and continuous variable 

polarization entanglement, Physical Review A 65 (2002), 052306. 
[14] C. Kurtsiofcr, P. Zarda, M. Haider, H. Woinfurter, P. M. Gorman, P. R. Tapster, and J. G. Rarity, A step towards global 

key distribution, Nature 419 (2002), no. 6906, 450-450. 
[15] R. Namiki and T. Hirano, Security of quantum cryptography using balanced homodyne detection. Physical Review A 67 

(2003), no. 2, 022308. 

[16] C. Silberhorn, T. C. Ralph, N. Liitkenhaus, and G. Leuchs, Continuous variable quantum cryptography: Beating the 3 db 
loss limit. Physical Review Letters 89 (2002), no. 16, 167901. 



